UZBEKISTAN \u00a0\u00b7\u00a0 DATA PROTECTION<\/p>\n
Bond Stone advises on data protection compliance programme implementation in Uzbekistan \u2014 database registration with the State Register of Personal Data Bases, DPO appointment, breach notification under Presidential Decree No. PP-153 (financial sector), cross-border transfer compliance under ZRU-547 as amended by Law No. 1125 (March 2026), and internal data protection policies for foreign-invested entities.<\/p>\n
Primary authority: Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 dated 2 July 2019 (as amended by Law No. 1125 dated 26 March 2026). Verify at lex.uz<\/a><\/p>\n \u26a0\ufe0f March 2026 Reform<\/p>\n Law No. 1125 dated 26 March 2026 fundamentally changed Uzbekistan’s data localisation rules. Only biometric, genetic, and telecommunications user data must now be stored in Uzbekistan. All other personal data may be stored abroad subject to security requirements.<\/p>\n<\/div>\n Database registration \u2014 State Register<\/p>\n Organisations processing personal data in Uzbekistan are required to register their personal data databases with the State Register of Personal Data Bases under Resolution No. 71 of the Cabinet of Ministers dated 8 February 2020. The State Personalization Center under the Cabinet of Ministers is the responsible authority. Bond Stone advises on the registration procedure, required documentation, registration timeline, and the categories of databases that are exempt from registration.<\/p>\n<\/div>\n DPO appointment<\/p>\n Organisations processing personal data in Uzbekistan must designate a person responsible for data protection \u2014 fulfilling the DPO function under ZRU-547. The responsible person oversees compliance with the Law, handles data subject rights requests, manages consent mechanisms, and liaises with the State Personalization Center. Bond Stone advises on DPO appointment, role definition, and minimum competency requirements.<\/p>\n<\/div>\n Financial sector \u2014 PP-153 obligations<\/p>\n Presidential Decree No. PP-153 dated 30 April 2025 introduced compulsory breach notification obligations and legal liability for data incidents specifically for financial sector entities \u2014 banks, payment organisations, micro-finance institutions, and insurance companies. Financial sector entities must implement: mandatory breach notification procedures; technical and organisational security measures against cyber incidents; internal data incident response plans; and regulatory reporting to the Central Bank and State Personalization Center. Bond Stone advises financial sector clients on PP-153 compliance frameworks.<\/p>\n<\/div>\n Cross-border transfer compliance \u2014 post-reform<\/p>\n Following Law No. 1125 (March 2026), non-restricted personal data may be transferred outside Uzbekistan subject to: (1) the receiving country providing adequate personal data protection (Cabinet of Ministers-approved list); or (2) data subject explicit consent for transfers to non-adequate jurisdictions; or (3) legal or treaty basis. Bond Stone advises on structuring cross-border data transfers within the new framework and drafting data transfer agreements for intercompany data sharing.<\/p>\n<\/div>\n Internal compliance programme<\/p>\n A complete data protection compliance programme under ZRU-547 includes: data mapping \u2014 identifying all processing activities; database registration; lawful basis analysis; privacy notices for employees and customers; consent management; data processing agreements with processors; data subject rights procedures; breach response plan; DPO function; and post-March 2026 localisation assessment. Bond Stone advises on building and implementing compliance programmes for foreign-invested entities operating in Uzbekistan.<\/p>\n<\/div>\n<\/div>\n Database Registration \u2014 Market Entry<\/p>\n Compliance \u00b7 Uzbekistan \u00b7 Corporate<\/p>\n Advising a foreign company establishing a Uzbek subsidiary on registering its personal data databases with the State Register \u2014 identifying registrable databases, preparing registration documentation, and engaging with the State Personalization Center.<\/p>\n<\/div>\n PP-153 \u2014 Bank Compliance Framework<\/p>\n Compliance \u00b7 Uzbekistan \u00b7 Banking<\/p>\n Advising a foreign bank’s Uzbek subsidiary on implementing the PP-153 breach notification and cybersecurity obligations \u2014 establishing a data incident response plan, breach classification criteria, notification timeline, and regulatory reporting procedures.<\/p>\n<\/div>\n Cross-border Transfer Agreement<\/p>\n Compliance \u00b7 Uzbekistan \u00b7 Corporate<\/p>\n Drafting an intragroup cross-border data transfer agreement for a multinational’s Uzbek subsidiary \u2014 covering non-restricted data categories eligible for offshore storage, security protocol requirements, and data subject rights provisions under ZRU-547.<\/p>\n<\/div>\n Privacy Notice \u2014 Digital Platform<\/p>\n Compliance \u00b7 Uzbekistan \u00b7 Technology<\/p>\n Drafting a ZRU-547-compliant privacy policy and consent notice for a digital platform operating in Uzbekistan \u2014 covering data categories, processing purposes, localisation status post-reform, cross-border transfer disclosure, and data subject rights.<\/p>\n<\/div>\n Data Processing Agreement \u2014 SaaS<\/p>\n Compliance \u00b7 Uzbekistan \u00b7 Technology<\/p>\n Drafting data processing agreements between a Uzbek entity and international SaaS vendors \u2014 processor obligations, sub-processing restrictions, breach notification requirements under PP-153, and data deletion provisions.<\/p>\n<\/div>\n Compliance Audit \u2014 Manufacturing<\/p>\n Compliance \u00b7 Uzbekistan \u00b7 Manufacturing<\/p>\n Conducting a data protection compliance audit for a foreign manufacturer’s Uzbek entity \u2014 reviewing processing activities against ZRU-547, database registration status, localisation post-reform, consent framework, and PP-153 applicability.<\/p>\n<\/div>\n<\/div>\n Why Bond Stone<\/p>\n \u2726 \u00a0Tashkent office \u2014 direct engagement with the State Personalization Center<\/p>\n \u2726 \u00a0Ranked Legal 500 EMEA and IFLR1000<\/p>\n<\/div>\n Primary authority: lex.uz<\/a><\/p>\n Contact Bond Stone for a confidential discussion about Data Protection Compliance in Uzbekistan.<\/p>\n \ud83d\udce7 info@bondstonelaw.com<\/a> Request a Confidential Consultation<\/a> UZBEKISTAN \u00a0\u00b7\u00a0 DATA PROTECTION Data Protection Compliance in Uzbekistan Bond Stone advises on data protection compliance programme implementation in Uzbekistan \u2014 database registration with the State Register of Personal Data Bases, DPO appointment, breach notification under Presidential Decree No. PP-153 (financial sector), cross-border transfer compliance under ZRU-547 as amended by Law No. 1125 (March 2026), […]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-4852","page","type-page","status-publish","hentry"],"translation":{"provider":"WPGlobus","version":"3.0.3","language":"ru","enabled_languages":["en","ru"],"languages":{"en":{"title":true,"content":true,"excerpt":false},"ru":{"title":false,"content":false,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/comments?post=4852"}],"version-history":[{"count":2,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4852\/revisions"}],"predecessor-version":[{"id":4854,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4852\/revisions\/4854"}],"wp:attachment":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/media?parent=4852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nKey Framework<\/h2>\n
\nExperience<\/h2>\n
\nDiscuss your data protection matter<\/h2>\n
\n\ud83d\udcde +7 (701) 729 76 72<\/a><\/p>\n
\n\u2190 Data Localisation<\/a>
\n\u2190 Data Protection Hub<\/a>
\n\u2190 Data Protection Hub<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"